I got a token from AAD using Msal, but can't get the user profile using the token acquired. How to validate the token simply on Node backend?

Question

I used the following configuration for requesting the token from AAD.

The app.module.ts file:

MsalModule.forRoot({
            clientID: 'CLIENT_ID',
            authority: "https://login.microsoftonline.com/TENANT_ID",
            validateAuthority: true,
            cacheLocation: 'sessionStorage',
            postLogoutRedirectUri: 'http://localhost:4200/authorize/signin',
            navigateToLoginRequestUrl: true,
            popUp: true,
            consentScopes: ['user.read', 'https://graph.microsoft.com']
        }

It returns the msal.idtoken, accesstoken, and some more msal key value pairs. Now following code is used to get the profile of the user by pasting the acquired MSAL_IDTOKEN.

const request = require('request');
const tok = 'MSAL_IDTOKEN HERE';
request.get({ url: "https://graph.microsoft.com/v1.0/me", headers: { "Authorization": "Bearer " + tok, "Content-type": "application/json" } }, function (err, response, body) {

    if (err) {
        console.log('err', err);
    }
    else
        console.log(response.body);
})

Now after running the app on Node, it used to return the profile of the user, as found after decoding the token, but now it does not.

Answer 1

I see that you have the right config on the Portal.

If you are using MSAL.js, given some code like this:

    this.app = new Msal.UserAgentApplication(

        this.applicationConfig.clientID,

        `https://login.microsoftonline.com/${AzureADName}/`,

        () => {

            // callback for login redirect

        },

        {

            redirectUri

        }

    );

You would then call this to get user information:

this.app.getUser();

or

this.app.getAccount();

You would have to provide version information to be sure, as the API was changed.

Answer 2

Get User Profile only works for msal": "^0.2.4" and not for the current version 1.1.

Answer 3

It seems that your are trying to read user profile from your access token.

To do that you need to assign profile dedicated permission on azure portal.

See the screen shot below:

Note: After assigning permission you can check your token on https://jwt.io/ whether it contains required permission.

Token Claim:

Read User data:

Code Snippet:

Token Class:

 public class AccessTokenClass
        {
            public string token_type { get; set; }
            public string expires_in { get; set; }
            public string resource { get; set; }
            public string scope { get; set; }
            public string access_token { get; set; }
            public string refresh_token { get; set; }

        }

Token Method:

private async Task<string> GetTokenByROPCFormat()
        {

            string tokenUrl = $"https://login.microsoftonline.com/YourTenantIdOrName/oauth2/token";

            var tokenRequest = new HttpRequestMessage(HttpMethod.Post, tokenUrl);

            tokenRequest.Content = new FormUrlEncodedContent(new Dictionary<string, string>
            {
                ["grant_type"] = "password",
                ["client_id"] = "b603c7be-a866--e6921e61f925",
                ["client_secret"] = "Vxf1SluKbgu4PF0Nf3wE5oG",
                ["resource"] = "https://graph.microsoft.com",
                ["username"] = "kironmemb@MyTenant.onmicrosoft.com",
                ["password"] = "@Mypassword"

            });

            dynamic json;
            dynamic results;
            HttpClient client = new HttpClient();

            var tokenResponse = await client.SendAsync(tokenRequest);

            json = await tokenResponse.Content.ReadAsStringAsync();
            results = JsonConvert.DeserializeObject<AccessTokenClass>(json);
            Console.WriteLine("Your Refresh Token=>{0}", results.refresh_token);



            //  New Block For Accessing Data from API
            HttpClient newClient = new HttpClient();

            HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, "https://graph.microsoft.com/v1.0/me");

            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", results.access_token);
            HttpResponseMessage response = await newClient.SendAsync(request);

            string output = await response.Content.ReadAsStringAsync();
            return output;




        }